Personal Information Leaks Surge 8.6 Times in Five Years... Focus on Preemptive Defense in the AI Era

PIPC Unveils Third Basic Plan for Personal Information Protection (2027–2029)

Focus on Risk Defense Against Agentic and Physical AI

Stronger Incentives and Penalties for Personal Information Breaches

The Personal Information Protection Commission announced on July 3 its “3rd Basic Plan for Personal Information Protection (2027–2029),” which focuses on practical risk mitigation in response to the normalization of artificial intelligence (AI) in daily life and the evolution toward agentic and physical AI. This plan goes beyond previous basic policies that primarily set foundational standards for the advent of generative AI. While enabling companies to use AI data more flexibly and boldly, the plan requires businesses and chief executive officers (CEOs) to establish robust preemptive defense systems against sophisticated AI threats, such as deepfakes and autonomous AI.

Specifically, the Commission plans to review the decision-making accountability structure of agentic AI and establish standards to guarantee rights in response to the constant information collection by physical AI. In this context, the “AI Privacy Public-Private Policy Council,” consisting of 37 experts, was launched in February. In June, the Commission announced the “R&D and Standardization Roadmap (2026–2030) for Full Lifecycle Personal Information Protection and Utilization Technology,” which includes the development of new, tailored technologies to block AI risks.

The Commission explained, “With the explosive increase in data utilization demands in the AI era, the need for innovation and support in personal information systems has grown,” adding, “Countries around the world, including Europe and Japan, are also pursuing system improvements for the safe use of personal information in the AI era.” In fact, the European Union (EU) has enacted the world’s first comprehensive AI regulatory law, the “EU AI Act,” which is now being implemented in phases.

This basic plan is also intended to prepare for the possibility that personal information leaks, occurring across industries such as telecommunications and distribution, may become even more severe cyber threats with the support of AI. According to the Commission, the number of personal information leak reports increased from 219 cases in 2020 to 447 cases last year, nearly doubling. During this period, the scale of leaked information surged 8.6 times, from 12,003,000 cases to 103,546,000 cases. Information leaked from just two companies—Coupang and SK Telecom—exceeded 60 million cases.

To prevent such large-scale breaches, the Commission has decided to encourage companies to voluntarily invest in security and to strengthen CEOs' legal liability. An amendment to the “Personal Information Protection Act,” which allows for punitive fines of up to 10 percent of total annual revenue for repeated or serious personal information leaks, is scheduled to take effect on September 11. Reduction of fines—presented as an incentive—will only apply to companies that have proactively invested in personal information protection. The reduction rate is being specified at up to 40 percent and is currently under legislative notice.

The Commission also aims to streamline regulatory frameworks among ministries centered on the Personal Information Protection Act, eliminating redundant regulations and strengthening the control tower function. Lee Sangmin, Director of the Data Policy Bureau at the Personal Information Protection Commission, said, “This basic plan focuses on establishing a personal information protection system in response to the advent of an AI-based society and on creating an environment for AI innovation where data can be used safely, based on public trust.” He added, “By formulating and implementing action plans for each ministry, we will support the arrival of an AI society where the public can enjoy and feel secure.”

This content was produced with the assistance of AI translation services.